---
typeId: req
recordId: benac-desc-004
fields:
  title: Secret references in descriptors
  statement: Descriptors may reference secrets by local secret reference, but
    shall not contain raw secret material by default.
  rationale: Descriptors may replicate; secrets should not.
  verification: Descriptor export contains secret reference metadata, not raw value.
  testable: true
  status: draft
  area: BENAC-DESC
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.7 Package model, descriptors, and package claims
  order: 86
---
